EUVD-2026-54078
GHSA-hw79-7vhm-4hc6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint, no complexity or interaction needed; sole impact is complete availability loss with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured.
AnalysisAI
Unauthenticated remote shutdown of OpenChamber 1.11.7 is possible by sending a single POST request to /api/system/shutdown, terminating the server process and instantly denying service to all active AI coding sessions. The flaw stems from the /api/system/shutdown route being registered before the authentication middleware in the Express handler chain within bootstrap-runtime.js, meaning authentication is never evaluated for that endpoint regardless of whether UI_PASSWORD is configured. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The /api/system/shutdown Express route must be reachable over the network - this is the case for any Docker deployment using the default 0.0.0.0 bind address or any Electron desktop instance with LAN access enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects a fully unauthenticated, zero-complexity, network-exploitable denial-of-service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to the OpenChamber HTTP port sends a single 'POST /api/system/shutdown HTTP/1.1' request with no credentials or session token; the Express router matches the shutdown route before the authentication middleware fires, immediately terminating the server process and dropping all active AI coding sessions for every connected user. The commit diff and VulnCheck advisory provide sufficient detail for any attacker to reproduce this without a separate POC, though no standalone exploit code has been confirmed published. |
| Remediation | Apply the vendor-released patch at commit f1b9506132faf6c564a2694c7f33b94421a49b4a (https://github.com/openchamber/openchamber/commit/f1b9506132faf6c564a2694c7f33b94421a49b4a); a tagged release version has not been independently confirmed from the available data, so treat the upstream commit as the authoritative fix reference. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, assess whether OpenChamber 1.11.7 instances are exposed to untrusted networks and implement temporary network controls (firewall rules restricting POST requests to /api/system/shutdown endpoint or blocking access to /api/system/ routes) as interim protection. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openchamber
View allUnauthenticated arbitrary file read in OpenChamber 1.11.7 lets remote attackers pull any file off the host by setting th
Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing t
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today